rpms/perl-Archive-Tar
7
0
Fork 0
Code Issues Pull Requests Releases Activity
A module for Perl manipulation of .tar files
6 Commits 27 Branches 26 Tags 183 KiB
c8s
Go to file
RHEL Packaging Agent 9d88ce3679 Fix CVE-2026-9538: cap per-entry declared size to prevent memory DoS 
Backport upstream commit f9af0142 to perl-Archive-Tar on c8s.
The patch adds a $MAX_FILE_SIZE variable (default 1 GiB) and a
size check in _read_tar() that refuses to allocate memory for
entries whose declared size exceeds the cap. This defends against
CVE-2026-9538, where an attacker-controlled tar header size field
could trigger multi-GB memory allocation via a small compressed
archive.

CVE: CVE-2026-9538
Upstream patches:
 - f9af014260.patch
Resolves: RHEL-191913

This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.

Assisted-by: Ymir
2026-07-03 08:17:30 +00:00
.gitignore re-import sources as agreed with the maintainer 2023-06-30 07:33:03 +02:00
.rpmlint re-import sources as agreed with the maintainer 2023-06-30 07:33:03 +02:00
Archive-Tar-2.02-Do-not-sleep-in-Makefile.PL.patch Auto sync2gitlab import of perl-Archive-Tar-2.30-1.el8.src.rpm 2022-05-26 12:48:55 -04:00
perl-Archive-Tar.spec Fix CVE-2026-9538: cap per-entry declared size to prevent memory DoS 2026-07-03 08:17:30 +00:00
RHEL-181654.patch Fix CVE-2026-42496 in perl-Archive-Tar (symlink/hardlink validation) 2026-06-05 16:20:16 +00:00
RHEL-191913.patch Fix CVE-2026-9538: cap per-entry declared size to prevent memory DoS 2026-07-03 08:17:30 +00:00
sources Auto sync2gitlab import of perl-Archive-Tar-2.30-1.el8.src.rpm 2022-05-26 12:48:55 -04:00